Attacks/Breaches
1/2/2014
07:38 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Snapchat To Update App In Wake Of Breach

App vendor planning new version that lets users opt out of appearing in beleagured 'Find Friends' feature

Snapchat, a mobile photo-messaging app created for wiping out traces of the messages for privacy reasons, this week was hit with a major breach of its users' privacy that exposed names and phone numbers of some 4.6 million of its customers. The data dump came after security researchers published a proof-of-concept for a weakness associated with the "Find Friends" feature.

The app provider late today announced that it would update Snapchat to better protect its users. "We will be releasing an updated version of the Snapchat application that will allow Snapchatters to opt out of appearing in Find Friends after they have verified their phone number. We’re also improving rate limiting and other restrictions to address future attempts to abuse our service," Snapchat said in a blog post.

Snapchat also said researchers could email the firm at security@snapchat.com for any vulnerability discoveries. "We want to make sure that security experts can get a hold of us when they discover new ways to abuse our service so that we can respond quickly to address those concerns. The best way to let us know about security vulnerabilities is by emailing us: security@snapchat.com," Snapchat said.

The blog post came in response to criticism by the researchers who first reported and then published details on the flaw in Snapchat's app after saying they had not gotten a response from Snapchat. A hacker group yesterday exploited the flaw and posted online to a site called SnapchatDB the names and phone numbers, with the final two digits obscured, on some 2.6 million Snapchat users.

"As much as we were hoping it wouldn't be exploited, we did expect at least something to come of it. We don't condone the Snapchat DB leak, and feel that it's a pretty reckless way to get across the point to Snapchat," researchers at Gibson Security told Dark Reading in an email interview.

The researchers say they tried to contact Snapchat in August electronically before their original post about the flaw. On Dec. 27, Snapchat posted a blog basically dismissing the vulnerabilities. "This week, on Christmas Eve, a security group posted documentation for our private API. This documentation included an allegation regarding a possible attack by which one could compile a database of Snapchat usernames and phone numbers," Snapchat said in that post. "Theoretically, if someone were able to upload a huge set of phone numbers, like every number in an area code, or every possible number in the U.S., they could create a database of the results and match usernames to phone numbers that way. Over the past year we’ve implemented various safeguards to make it more difficult to do. We recently added additional counter-measures and continue to make improvements to combat spam and abuse."

Find Friends basically lets users upload their contacts list to Snapchat so that Snapchat can display the accounts of users that match those phone numbers.

Gibson Security said Snapchat's director of operations contacted them via email, but that they hadn't heard anything since then as of this morning.

The breach of user information is another example of the risks associated with many mobile apps today, security experts say. "In a rush for growth, companies often put security on the back burner. Snapchat here is no exception. What we see here is a classic example of how the intersection of social media, mobile platforms, and cloud create new entry doors for the hackers to exploit. Today’s rapid moving parts and the plethora of connections make it all too easy for the attackers," says Bala Venkat, CMO at Cenzic.

Kevin O’Brien, director of product marketing at CloudLock, says this low bar of entry into the mobile app space basically complicates security. The Snapchat customer data dump has damage potential to the users, he says.

"Spoofed phone calls" are one potential abuse, he says, as well as criminals using the phone numbers, geographic information, and usernames for identity theft or to escalate victims' user privileges elsewhere. "PII [personally identifiable information] is valuable. It allows you to get closer to the target," O'Brien says.

Gibson Security, meanwhile, suggests users delete their Snapchat accounts or contact their mobile phone network providers to change their phone numbers if they are especially concerned those numbers could be fully discerned by prospective attackers. "They should definitely ensure their security and privacy settings are up to date and well adjusted in all their social media accounts. Users should perform due diligence when registering for new social media accounts -- if a site doesn't deserve [or shouldn't have] your phone number, don't give it to them," the researchers say.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4594
Published: 2014-10-25
The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment.

CVE-2014-0476
Published: 2014-10-25
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.

CVE-2014-1927
Published: 2014-10-25
The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928....

CVE-2014-1928
Published: 2014-10-25
The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulner...

CVE-2014-1929
Published: 2014-10-25
python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.